Privacy Policy
How we handle personal data, including information relating to children and parent accounts.
1. Controller
Heartwing Entertainment Ltd, Cyprus, is the controller of personal data processed through GinaHeartwing.com and Gina Heartwing services, except where another provider acts as an independent controller for its own service. Incorporation details and registered-office information will be added to the Legal Notice when available.
2. Information we may process
Depending on the features used, we may process:
- parent or adult account information, such as name, email address and authentication identifiers;
- limited child-profile information, such as a chosen first name or nickname, avatar or companion selection;
- game and learning progress, Sparks, unlocks, saved stories, songs, collections and preferences;
- transaction records, product identifiers and payment confirmation, while full payment-card details are normally handled by the payment provider rather than stored by us;
- device, browser, app version, security, crash and technical log information;
- support messages and information voluntarily supplied by a parent or user;
- consent and parental-authorisation records where required.
3. Why we use personal data
We use personal data to provide and secure accounts, save progress, deliver purchased content, synchronise permitted settings, provide support, prevent fraud and abuse, comply with legal obligations, improve reliability and, where consent is required, operate optional analytics or communications.
4. Legal bases
Depending on the processing, our legal basis may be performance of a contract, compliance with a legal obligation, our legitimate interests in operating and securing the service, or consent. Where processing of a child’s data relies on consent, the applicable child-consent rules are followed.
5. Children
Under Cyprus Law 125(I)/2018, where an information-society service is offered directly to a child and processing is based on consent, a child aged 14 or over may give that consent in Cyprus; for a child under 14, consent must be given or authorised by the holder of parental responsibility. Different age thresholds may apply in other countries, and we apply the relevant local rule where required.
We seek to avoid asking children for unnecessary personal information. Parent-controlled account functions should be used for purchases, consent choices and account administration where appropriate.
6. No sale of personal data and no behavioural advertising to children
We do not sell children’s personal data. Gina Heartwing is not intended to use behavioural advertising directed at children. If advertising or analytics technologies are introduced, they will be assessed for child privacy and consent requirements before use.
7. Service providers
We may use vetted providers for hosting, cloud infrastructure, authentication, email delivery, payment processing, customer support, security, analytics or app distribution. They may process information only for the relevant service and subject to appropriate contractual and security arrangements, unless they act as an independent controller under their own terms.
8. International transfers
Where personal data is transferred outside the European Economic Area, we use an available lawful transfer mechanism where required, such as an adequacy decision, standard contractual clauses or another recognised safeguard.
9. Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including account operation, legal, tax, security, dispute and record-keeping requirements. Retention periods may differ by data type. Child-profile data should be deleted or anonymised when it is no longer needed.
10. Your rights
Subject to the GDPR and applicable law, individuals may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent. A parent or guardian may exercise applicable rights in relation to a child where legally entitled to do so.
11. Complaints
You may contact us first so that we can try to resolve a privacy concern. You also have the right to complain to the Office of the Commissioner for Personal Data Protection in Cyprus or, where applicable, another competent supervisory authority.
12. Security
We use technical and organisational safeguards appropriate to the nature of the service, including access controls, secure transmission, software updates, logging, backups and measures intended to reduce unauthorised access, code injection, fraud and abuse. No online system can be guaranteed to be completely secure.
13. Contact
Privacy enquiries and data-rights requests may be sent to privacy@ginaheartwing.com.